fil[.]app-airdropalert[.]sbs

The domain fil.app-airdropalert.sbs was registered through Dynadot LLC on 10 November 2025. It resolves to the IP address 142.250.185.196, which is owned by AS15169 Google LLC and is geolocated in the United States. The site presents a page title of “Google” and is classified as a brand‑impersonation campaign targeting Google users. Intelligence indicates the campaign is a crypto scam, although the specific payment mechanism or malicious payload has not been disclosed. No SSL certificate is offered, leaving the connection unencrypted and vulnerable to man‑in‑the‑middle observation.

Nameserver configuration uses Cloudflare services (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. It has been blocked by PhishDestroy and is listed on at least one public blocklist. VirusTotal analysis reports that 13 out of 95 scanning engines flagged the domain as malicious, providing a multi‑vendor consensus of malicious intent. The site is currently taken offline, but the underlying IP and nameserver infrastructure remain active, allowing rapid re‑deployment.

The exact page markup and any credential‑harvesting forms have not been released, so visual characteristics are unknown. Defenders should add the domain and its resolving IP to DNS‑level deny lists, enforce HTTPS‑only policies, and block any outbound connections to the identified IP. Continuous monitoring of the Cloudflare nameservers is recommended to detect future re‑registration or changes. Correlation with other Google‑impersonation incidents may reveal shared command‑and‑control infrastructure. Given the zero trust score, existing blocklist entries, and multi‑vendor detections, the domain should be incorporated into internal phishing‑prevention feeds and threat‑intel sharing platforms.